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Abstract: A commonly used model for fault-tolerant computation is that of cellular automata. The essential 
difficulty of fault-tolerant computation is present in the special case of simply remembering a bit in the 
presence of faults, and that is the case we treat in this paper. The conceptually simplest mechanism for 
correcting errors in a cellular automaton is to determine the next state of a cell by taking a majority vote 
among its neighbors (including the cell itself, if necessary to break ties). We are interested in which regular 
two-dimensional tessellations can tolererate faults using this mechanism, when the fault rate is sufficiently 
low. We consider both the traditional transient fault model (where faults occur independently in time and 
space) and a recently introduced combined fault model which also includes manufacturing faults (which occur 
independently in space, but which affect cells for all time). We completely classify regular two-dimensional 
tessellations as to whether they can tolerate combined transient and manufacturing faults, transient faults 
but not manufacturing faults, or not even transient faults. 



1. Introduction 

The results of this paper complement those of our previous paper, McCann and Pippenger [M3]. In 

that paper, we studied the fault-tolerance of certain cellular automata at high fault rates (close to 1/2), and 
in this one we study the case of low fault rates (close to 0). In this introduction, we shall quickly describe 
the models we shall use; fuller discussion and motivation can be found in [M3]. 

In the theoretical study of fault-tolerant computation, the cellular automaton is one of the most fre- 
quently studied models. This status comes about in the following way. The most important theoretical model 
for computation, the Turing machine, is unsuitable for the study of fault-tolerant computation because it 
leaves large amounts of data on its tape unattended for long periods of time while its head is elsewhere. If 
each tape cell suffers a fault with fixed probability at each time step, the head (which can alter the contents 
of only one cell per time step) has no hope of correcting these faiilts. To evade this problem, it is natural 
to endow each tape cell with the ability to perform simple computations for the purpose of correcting local 
errors. When this is done, the tape becomes a cellular automaton, and it is then natural to have the compu- 
tation performed by the cellular automaton in parallel, rather than serially by a moving head. Deterministic 
cellular automata were introduced by Ulam [U] and von Neumann [N2]. Their probabilistic counterparts 
were introduced by Stavskaya and Pyatetskii-Shapiro [S], and were used to study fault- tolerant memory by 
Toom [Tl, T2]. 

In the study of fault-tolerant computation by cellular automata, it is natural to separate the functions 
of fault-tolerant memory and computation. In light of this separation, it is sufficient to consider the fault- 
tolerant cellular automata that remember a single bit, for they can then be combined with universal cellular 
automata for computation to obtain universal fault-tolerant cellular automata. This idea is due to Gacs and 
Reif [Gl]. A suitable two dimensional universal cellular automaton with just two states per cell (the "Game 
of Life") has been invented by Conway (sec Gardner [G2], or Berlckamp, Guy and Conway [B]). Thus we 
shall focus attention on binary cellular automata, in which each cell has just two possible states. 

For the correction of errors in binary cellular automata, majority voting is the most natural mechanism, 
and we will restrict attention in this paper to symmetric majority voting, in which the next state of each cell 
is the result of a majority vote among the current states of the cells neighbors, including the current state 
of the cell itself if the number of neighbors is even. This mechanism has many pleasant properties stemming 
from the fact that the majority function is monotone (changing an input from to 1 cannot change the 
output from 1 to 0) and self- dual (complementing all the inputs complements the output). Error-correction 
by majority voting was first analyzed by von Neumann [Nl] in the context of Boolean circuits, and by Toom 
[Tl, T2] for cellular automata. The limitations of symmetric majority voting were discussed by Pippenger 
[P]- 

The cellular automata we consider are based on "tessellations" . A tessellation is an embedding of a 
graph into the sphere (if the graph is finite) or the plane (if the graph is infinite). The vertices and edges of 
the graph then divide the surface into which it is embedded into faces. We focus on cellular automata based 
on regular tessellations, in which every vertex has the same degree q, and every face has the same degree p 
(see Coxeter [CI]). Thus the cellular automata we study have one cell at each vertex of the graph, with the 
neighbors of a cell being the cells located at adjacent vertices. (Since the cells of a cellular automaton are 
in one-to-one correspondence with the vertices of its graph, we could if we wished use the terms "cell" and 
"vertex" interchangeably, or use one of these terms to the exclusion of the other. We shall, however, usually 
use the term "vertex" when the context is graph-theoretic (that is, based on the edges and faces of the 
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tessellation), and the term "cell" when the context is automata-theoretic (that is, when the notions of state, 
fault or error are involved).) Coxeter tessellations are denoted {p, q}, for p E {3, 4, . . . , 00} and q G {2,3, . . .}. 
(The preceding sentence brings out the need to distinguish the use of {p, q} to name a tessellation from its 
use to name a set with two elements (or one if {p,q}). This notation is well established for both purposes, 
however, and the meaning will always be clear from context.) The graph of {p, q} has q faces (which are 
p-gons) meeting at each vertex; if p = 00, it is an infinite g'-regular tree (that is, an infinite tree in which 
every vertex has degree q). These tessellations fall into three classes, as follows. For l/p+l/q> 1/2, {p, q} 
is a finite tessellation of the sphere, corresponding to one of the Platonic solids (or, for p < 00 and q = 2, 
to two polygonal faces meeting at the equator). For 1/p + 1/q = 1/2, it is an infinite tessellation of the 
Euclidean plane (or, for p = 00 and q = 2, a tessellation of a line in the Euclidean plane). Finally, for 
1/p + 1/g < 1/2, it is an infinite tessellation of the hyperbolic plane, with q p-gons meeting at each vertex 
(or, for p = 00 and g > 3, an infinite g-regular tree). As we shall see below, only the hyperbolic tessellations 
have any hope of being fault tolerant with symmetric majority voting. Although the tessellations of greatest 
interest for us are most naturally viewed as lying in the hyperbolic plane (where, according to hyperbolic 
geometry, all edges can have the same length and all faces the same area), hyperbolic geometry will play no 
role in our proofs, which are completely combinatorial in their methods. The first study of cellular automata 
based on hyperbolic tessellations of the plane appears to be that of Wagner [W], who investigated "modular" 
computers in which a "module" was located at each vertex of {5,5}. 

We come now to the specification of the fault models we shall consider. We assume that the automaton 
is trying to remember a bit x £ {0, 1}. In this case, all the cells are initialized to state x, and any cell that at 
any subsequent time is in the complementary state x is said to be in error at that time. The most natural 
model for faults in a binary cellular automaton is this: at each cell and each time step, the state of the cell 
is complemented independently with some probability e > 0. (This model is called the purely probabilistic 
fault model.) For various reasons (which are discussed more fully in McCann and Pippenger [M3]), it is 
customary to work with a model which incorporates an adversarial as well as a probabilistic aspect. At 
each cell and each time step a fault occurs independently with some probability e > 0. An adversary, who 
knows the value of x and the locations of faults for all places and times, then gains control of the state of 
each cell at each time at which a fault occurs for that cell. The goal of the adversary to to maximize the 
probability that an error occurs at a particular cell at a particular time. (This is called the adversarial fault 
model. It is equivalent to the model used by Toom [Tl, T2], where the role of the adversary is played by 
taking a supremum over a set of measures.) For a binary automaton with a monotone transition rule (such 
as majority voting), the "greedy strategy" (create an error at any time and place at which a fault occurs) 
simultaneously maximizes the probability of error at all times and all places. Furthermore, for a self-dual 
transition rule (such as majority voting), it is only necessary to consider one of the two possible values of 
X (since self-duality then allows us to deduce the behavior of the automaton for the other value). We shall 
therefore always assume that a; = 0, so that a particular cell is in error at a particular time if and only if it 
is in state 1 at that time. 

The faults described in the preceding paragraph are transient faults, because if a fault occurs at a 
particular cell at a particular time, it docs not affect the probability that a fault will occur at that cell at 
any future time. McCann [M2] has introduced a fault model that is appropriate for studying manufacturing 
faults, where each such fault occurs initially (during "manufacturing") and affects a cell for all time (that 
is, gives control of the state of the cell to the adversary for all time). We shall study a combined fault 
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model, in which each cell independently suffers a manufacturing fault with probability /3 > 0, and suffers a 

transient fault at each time independently with probability a > 0. We shall usually refer only to the single 
parameter e — I — {1 — a){l — l3) — a + /3 — af3, which is the probability that a particular cell is controlled 
by the adversary at a particular time. For either transient or combined faults, we shall say that a cellular 
automaton is fault tolerant if the probability that a particular cell is in error at a particular time is bounded 
by some quantity S <l/2 whenever e > is sufficiently small. (In fact, in our positive results, we shall see 
that we can take 5 = 0{e) as e — > 0.) 

Our results give a complete classification of the regular two-dimensional tessellations into three classes: 
those that can tolerate combined faults (for a binary cellular automaton with symmetric majority voting), 
those that cannot tolerate combined faults but can tolerate transient faiilts, and those that cannot even 
tolerate transient faults. For brevity, we shall speak of a tessellation tolerating faults of a given type, 
meaning that a binary cellular automaton based on that tessellation, and using symmetric majority voting, 
tolerates faults of that type when the fault rate e > is sufficiently small. This classification is summarized 
in the following table. 
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Here ig) means "tolerates combined faults" , x means "tolerates transient faults, but not combined faults" , 
and • means "does not even tolerate transient faults" . 

Our results on transient faults are ultimately based on two established techniques: for negative results, 
the notion of a "self-sustaining island" (implicit in the work of Toom [T2]), and for positive results, a theorem 
(also due to Toom [T2]) that gives a sufficient condition for a cellular automaton to tolerate transient faults. 
To apply Toom's theorem, however, we have had to develop a new technique, based on edge- colorings of 
tesseUations that satisfy a certain invariance property: all shortest paths from the origin to a given vertex have 
the same distribution of colors. We call these edge-colorings "shortcst-path-invariant addressing schemes" . 
(Schemes for describing paths in hyperbolic tessellations have been given for {5, 5} by Wagner [W] and for 
{4,5} and {5,4} by Marganstern [Ml], but these schemes do not possess the shortest-path-invariance that 
we need for the application of Toom's theorem.) Even this additional technique by itself, however, does not 
suffice for the tessellations {3, q} with q >7. In this case, the automaton does not appear to make enough 
progress in error correction during one time step to allow a direct application of Toom's theorem, though it 
does do so in two time steps. We have thus been led to introduce the notion of the "re-fold speed-up" of a 
cellular automaton (which accomplishes in one step what the original automaton accomplishes in k steps), 
and to show that if the sped-up automaton tolerates transient faults, then so does the original automaton. 

Our results on combined faults are based on entirely new methods. Our negative results for combined 
faults use the notion of a "pier-supported bridge", analogous to the notion of a self-sustaining island that 
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was used for transient faults. Our positive results for combined faults cannot use Toom's theorem, whose 

proof depends on the transience of the faults in an essential way. Instead, we prove an analogous theorem 
that gives a sufficient condition for a cellular automaton to tolerate combined faults. To apply it, we use a 
"balance of payments" argument that is based not an edge-coloring (as was the case for Toom's theorem), 
but rather on an assignment of flows to edges. 

In Section 2, we shall develop the combinatorial facts concerning regular hyperbolic tessellations that 
we shall need in subsequent sections, including the edge colorings that we shall use in our applications of 
Toom's theorem. Our results on transient faults are presented in Section 3, and those on combined faults 
are presented in Section 4. 

2. Regular Hyperbolic Tessellations 

All of our positive results apply to hyperbolic tessellations; spherical and Euclidean tessellations are 
covered by our negative results: they do not even tolerate transient faults. In this section, we collect various 
combinatorial facts about regular hyperbolic tessellations that we shall need in later sections. The tessellation 
with faces of degree p and vertices of degree q is denoted {p, q}. This tessellation is hyperbolic if and only if 
1/p +l/q < 1/2. This inequality is satisfied for p = oo and g' > 3, for p > 5 and g' > 4, for p = 4 and q>5, 
and for p = 3 and q>7. 

Let G = {V,E), with vertices V and edges E, be the undirected graph of the tessellation {p,q}. Two 
vertices a and b inV are adjacent, or neighbors of each other, if they are joined by an edge {a, b} in E. Every 
vertex in G has degree q. The tessellation consists of an embedding of G into the plane, in such a way that 
every face of the embedding has degree p. 

Let us choose a vertex as the origin in {p, q}. This choice partitions the vertices into sets that we shall 
call generations according to their distance (as measured by the number of edges in a shortest path) from 
the origin. Generation comprises just the origin; for 5 > 1, generation g comprises those vertices that 
are accessible through a path of length g, but no shorter path, from the origin. Every edge either joins two 

vertices in consecutive generations, or joins two vertices in the same generation. If vertex a in generation 
5 > is joined by an edge with vertex b in generation g + l,we shall say that a is a parent of b, or that b is 
a child of a, and that the edge is a parent-child edge. 

The simplest regular hyperbolic tessellations are the tessellations {00, q} with g > 3, which have no 
finite cycles, and thus are infinite trees. The origin has no parents and q children; every other vertex in 
generation g >1 has one parent in generation g — 1 and q — 1 children in generation g +1. Every edge is a 
parent-child edge. 

The remaining tessellations {p,q} are those with finite p > 3. Their study breaks into two parts, 
according to whether p is even or odd. If p > 4 is even, every face, and therefore every cycle, contains an 
even number of edges, so that the graph is bipartite. Its vertices may therefore be colored with two colors 
in such a way that every edge joins vertices with different colors. Since every vertex in generation 5 > 1 is 
joined by edges with vertices in the previous and subsequent generations, this two-coloring must assign one 
color to vertices in even generations and the other to vertices in odd generations. Thus no edge can join 
vertices in the same generation, so every edge is a parent-child edge. 

On the other hand, if p > 3 is odd, there must be edges joining vertices in the same generation, since 
otherwise coloring vertices according to the parity of their generations would yield a two-coloring of a graph 
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containing odd cycles. Edges joining vertices in the same generation g >1 will be called either sibling edges 

(if p = 3, so that the vertices have a eommon parent in generation g — 1), or cousin edges (if p = 2r + 1 > 5, 
so that the vertices have a most recent common ancestor in generation g — r < g — 2). (One should not read 
too much into this terminology: vertices that are siblings have just one parent in common, not two, and they 
also have a child in common!) Vertices joined by a sibling (respectively, cousin) edge will be called siblings 
(respectively, cousins) of each other. 

The simplest regular tessellations {p, q} with even p are those with p = 4, which are hyperbolic for 

q > 5. Consider two consecutive vertices a and b in generation g > 1, with a to the left of b. (We shall say 
"to the left" (respectively, "to the right") to mean counterclockwise (respectively, clockwise) in the cyclic 
order of a generation. By the "predecessor" (respectively, "successor" ) of a vertex, we shall mean the next 
vertex to its left (respectively, right) in the cyclic order of a generation. We shall say that two vertices are 
"consecutive" if one is the predecessor of the other.) The vertices a and b lie on a common face of degree 4, 
two of whose edges must join a and 6 to a common parent in generation g — 1, and two of whose edges must 
join them to a common child in generation g + 1. This common child will therefore have two consecutive 
parents: it is the rightmost child of a and the leftmost child of b. Any vertex that is neither a rightmost 
child nor a leftmost child will have just one parent. Since a vertex can have at most two parents, it must 
have at least — 2 > 3 children, and thus must have at least 3 — 2 = 1 of these intermediate children. We 
may therefore classify all vertices other than the origin into two classes: one-parent vertices and two-parent 
vertices. All the children of the origin are one-parent vertices; the leftmost and rightmost children of a vertex 
in generation g >1 are two-parent vertices, and all its intermediate children are one-parent vertices. 

The next simplest case is that of the tessellations {p, q} with even p = 2r > 6. These tessellations are 
hyperbolic when g > 4, but we shall only need to analyze those with q > 5, since for (7 = 4 our results are 
negative ({p, 4} cannot tolerate even transient faults) and they can be proved by considering a single face. 
Consider two consecutive vertices a and b in generation g > I, with a to the left of b. The vertices a and b lie 
on a common face of degree p, some of whose edges lie on a path P between a and b though their most recent 
common ancestor, and some of which lie on a path Q through their earliest common descendant. Since Q 
has length at least two, P has length at most p — 2. If P has maximal length, p — 2, then Q has length two, 
so the rightmost child of a will again be the leftmost child of b, and will again be a two-parent vertex. If, 
however, P has length less than p — 2, then Q will have length greater than two, so the rightmost child of a 
and the leftmost child of b will be distinct one-parent vertices. 

And as before, any children that are intermediate (neither leftmost nor rightmost) will be one-parent 
vertices. Again, since a vertex can have at most two parents, it must have at least q — 2 > 3 children, and 
thus must have at least 3 — 2 = 1 of these intermediate children. 

Lemma 2.1: For even p > 4 and g > 5, between a two-parent vertex in a generation g > 1 of {p, q} and the 

next two-parent vertex to its right must lie at least (j — 4 > 1 intermediate one-parent vertices. In particular, 
at least one of the parents of a two-parent vertex (since they are consecutive) must be a one-parent vertex. 

Proof: Let a be a two-parent vertex, and let b be the next two-parent vertex to its right. Then a must be 
the leftmost child of its right parent c. Since c has at most two parents, it must have at least g — 2 > 3 
children. The leftmost is a, and only the rightmost could be b. Thus there are at least q — 2 — 2 = q — A> 1 
intermediate one-parent children between a and b. □ 

We turn now to the case of {p, q} with odd p > 3. The simplest of these tessellations are those with 
p = 3, which are hyperbolic for q > 7. Each pair of consecutive vertices in generation g > 1 is joined by a 
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sibling edge, creating one face of degree three with their common parent in generation g — 1, and another 

such face with their common child in generation g + 1. Each vertex in generation g > 1 has at most two 
parents and exactly two siblings, and thus has at least q — 2~2 = g — 4>3 children. Only its leftmost and 
rightmost children are two-parent vertices, so there are at least 3 — 2 = 1 intermediate one-parent children 
between a and b. 

If from {3, q} we delete all sibling edges, we obtain another tessellation, which we shall denote {3, q}', 
that is "almost regular". In {3,g}', every face has degree four (since it was created by deleting a sibling 
edge that was formerly incident with two faces of degree three). The origin of {3, q}' has degree q, but every 
other vertex has lost its two former siblings as neighbors, and thus now has degree q — 2. The tessellation 
{3, (j}' can therefore be obtained by partitioning the edges and vertices other than the origin of {4:,q— 2} 
into q — 2 isomorphic "sectors", then arranging q of these sectors around the origin of {3,(7}'. 

Lemma 2.2: For q >7, between a two-parent vertex in a generation g > I oi {3, q} and the next two-parent 
vertex to its right must lie at least q — 6 > 1 intermediate one-parent vertices. In particular, if g > 8, at 
least one of the siblings of a one-parent vertex must be another one-parent vertex. 

Proof: Let a be a two-parent vertex, and let b be the next two-parent vertex to its right. Then a must be 
the leftmost child of its right parent c. Since c has at most two parents, and exactly two siblings, it must 
have at least q — 2 — 2 — q — 4:> 3 children. The leftmost is a, and only the rightmost could be b. Thus 
there arc at least q — 4 — 2 = q — 6> 1 intermediate one-parent children between a and b. □ 

Finally, we come to the last and most intricate case, that of {p, q} with odd p = 2r + 1 > 5. These 
tessellations are hyperbolic when g > 4, but we shall only need to analyze those with q> 5, since for g = 4 
our results are negative {{p, 4} cannot tolerate even transient faults) and they can be proved by considering 
a single face. 

Consider two consecutive vertices a and b in generation g > 1, with a to the left of b. There are three 
possible cases. Firstly, a and b may be joined by a path of length p—l = 2r through a most recent common 
ancestor in generation g — r. In this case, a and b are joined by a cousin edge that completes a face of degree 
p, and the rightmost child of a is distinct from the leftmost child of b, with both of these children being 
one-parent vertices. Second, a and b may be joined by a path of length p — 2 = 2r — 1 through a cousin edge 
joining two vertices in generation g — r + 1. In this case, a and b are not joined by a cousin edge, but the 
rightmost child of a is also the leftmost child of b, completing a face of degree p, and this common child is a 
two-parent vertex. Finally, if length of the shortest path from a to 6 through one or more vertices in earlier 
generations is at most p — 3 = 2r — 2, then a and b are not joined by a cousin edge, and the rightmost child 
of a is distinct from the leftmost child of 6, with both of these children being one-parent vertices. 

Lemma 2.3: In {p,q} with > 5 and q > h, & vertex can have at most two neighbors that are either its 
parents or its cousins. In particular, each vertex must have at least three children. 

Proof: Suppose, to obtain a contradiction, that a is a vertex with more than two neighbors that are parents 
or cousins, and that a is in the earliest generation g' > 1 in which such a vertex can be found. Then any 
parents of a must have at least three children. Suppose first that a has two parents 6 and c, with b to 
the left of c. Then a is the rightmost child of its left parent b. The predecessor d of a is therefore the 
second-rightmost child of b. Thus a cannot be joined by a cousin edge to its predecessor rf, since that would 
create a face with vertices a, b and d of degree three, contradicting the hypothesis that p > 5. Similarly, 
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a cannot be joined by a cousin edge to its successor, since this would create a face of degree three with its 
right parent. Thus, a two-parent vertex cannot have any cousins. 

Now suppose a has just one parent h. By the reasoning above, a can be joined by a cousin edge with 
its predecessor only if a is the leftmost child of its parent 6, and a can be joined by a cousin edge with 
its successor only if a is the rightmost child of its parent h. Since b has at least three children, these two 
possibilities are mutually exclusive, so a one-parent vertex can have at most one cousin. □ 

We may thus classify one-parent vertices into two classes: those incident with exactly one cousin edge 
will be called cousin vertices, and those not incident with a cousin edge will be called non-cousin one-parent 
vertices. By Lemma 2.3, every vertex other than the origin is a cousin vertex (and thus also a one-parent 
vertex) , a non-cousin one-parent vertex, or a two-parent vertex. 

Lemma 2.4: For p> 5 and q > 5, a. one-parent vertex in {p, q} has at most one two-parent child. 

Proof: Suppose, to obtain a contradiction, that a and b arc both two-parent children of the one-parent vertex 
c. Suppose, without loss of generality, that a is the leftmost child of c, and that b is the rightmost child of 
c. Let d be the left parent of a; then d is consecutive with c, which is the right parent of a. Let e be the 
right parent of b; then e is consecutive with c, which is the left parent of b. Let / be the parent of c. Neither 
d nor e can be a child of /, since doing so would create a face of degree four (a, c, d and /, or b, c, e and 
/), contradicting the hypothesis that p> 5. Thus /, which by Lemma 2.3 has at least three children, must 
have these children strictly between d and e, contradicting the fact that d, c and e are consecutive, so that 
c is the only vertex strictly between d and e. □ 

Lemma 2.5: For p > 5 and g > 5, both parents of a two-parent vertex in {p,q} are one-parent vertices. 
Indeed, they are non-cousin one-parent vertices. 

Proof: Let o be a two-parent vertex with left parent b and right parent c. Then b and c are consecutive. 

Suppose first, to obtain a contradiction, that at least one of b and c is a two-parent vertex. Suppose, 
without loss of generality, that 6 is a two-parent vertex. Let d be the right parent of b. By Lemma 2.3, d 
has at least three children. The leftmost is b, so the second- leftmost must be c (since c is the successor of b). 
Then a, b, c and d form a face of degree four, contradicting the hypothesis that q > 5. This contradiction 
shows that neither b nor c can be a two-parent vertex. 

Suppose then, to obtain a contradiction, that at least one of b and c is a cousin vertex. Suppose, without 
loss of generality, that b has a cousin e. The vertex e must be the predecessor of b (since c is the successor of 
b, so if it were a cousin of b, then a, b and c would form a face of degree three, contradicting the hypothesis 
that q > 5). Let d be the parent of b. By Lemma 2.3, d has at least three children. The leftmost must 
be b (since if e were a child of d, the vertices b, d and e would form a face of degree three, contradicting 
the hypothesis that ^ > 5). Thus has a least two children to the right of b. The second-leftmost must be c 
(since c is the successor of b). Then a, b, c and d form a face of degree four, contradicting the hypothesis 
that g > 5. This contradiction shows that neither b nor c can be a cousin vertex. Thus both parents of a 
two-parent vertex must be non-cousin one-parent vertices. □ 

Lemma 2.6: Of two vertices that are cousins of each other, at least one has a parent that is a non-cousin 
one-parent vertex. 

Proof: Suppose that vertices o and 6, with a to the left of 6, are cousins of each other. Since a and b 
are cousins, we must have q > b. Let c and d be the parents of a and 6, respectively. Since a and b are 
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consecutive, so are c and d, with c to the left of d. Suppose, to obtain a contradiction, that c and d are each 
either a two-parent vertex or a cousin vertex. 

Consider first the case that both c and d are two-parent vertices. Let e be the right parent of c. By 
Lemma 2.3, e has at least three children. The leftmost is c, and only the rightmost could be d. Thus there 
are at least 3 — 2 = 1 children between c and rf, contradicting the fact that c and d arc consecutive. 

Next consider the case that one of c and d is a two-parent vertex, while the other is a cousin vertex. 
Assume, without loss of generality, that c is a two-parent vertex, while d is a cousin vertex. Let / be the 
cousin of d. Then / must be the successor of d (since if it were the predecessor c of d, then a, b, c and d 
would form a face of degree four, contradicting the fact that g > 5). Let e be the right parent of c. By 
Lemma 2.3, e has at least three children. The leftmost is c, so the next two vertices to the right of c (namely 
d and /) must also be children of e. So d, e and / form a face of degree three, contradicting the fact that 
g > 5. 

Finally consider the case that c and d are both cousin vertices. They cannot be cousins of each other, 
since then a, b, c and d would form a face of degree four, contradicting the fact that q>5. Thus the cousin 
g of c must be the predecessor of c, and the cousin f of d must be the successor of d. Let e be the parent 
of c. By Lemma 2.3, e has at least three children. The leftmost must be c (since if g were a child of e, the 
vertices c, e and g would form a face of degree three, contradicting the fact that q > 5). Thus the next two 
vertices to the right of c (namely d and /) must be children of e. So d, e and / form a face of degree three, 
contradicting the fact that q> 5. D 

We turn now to the edge colorings that we shall use in our applications of Toom's theorem. These will 
only be needed for {4, q} with g > 5 and {3, q} with g > 7, so we shall restrict our attention to p G {3, 4}. 

An addressing scheme for a graph G = (V, E) with I colors is a function x '■ E ^ {0, . . . ,1 — 1} that 
assigns a "color" x(e) to each edge e in E, and that assigns distinct colors to the edges in E incident with 
a common vertex. An addressing scheme for G can be used to "navigate" in G: a path from one vertex to 
another can be described by giving the sequence of colors of the edges traversed by the path. 

For our results, we shall only need to deal with paths starting from a fixed origin, and only with 
shortest paths from the origin. We shall, therefore, need colors only for edges that lie on shortest paths 
from the origin. Let a vertex of G be distinguished as the origin. Let E' C E he the set of edges lying on 
shortest paths from the origin to other vertices. A partial addressing scheme for G with I colors is a function 
X ■ E' ^ {0, . . . ,1 — 1} that assigns a "color" x(e) to each edge e in E', and that assigns distinct colors to 
the edges in E' incident with a common vertex. (If p = A, then E' = E, so a partial addressing scheme 
is simply an addressing scheme; if p = 3, then E' is obtained from E by deleting all sibling edges, so only 
parent-child edges receive colors.) 

To apply Toom's theorem, we shall need partial addressing schemes that satisfy an additional constraint. 
A partial addressing scheme x is shortest-path-invariant if, for any vertex a in V, any two shortest paths P 
and Q from the origin to a, and any color k G {0, . . . ,1 — 1}, the number of edges with color A; in P is the 
same as the number of edges with color k in Q. This common number will be denoted \a\k- If the number of 
edges on a shortest path from the origin to a (that is, the number of the generation containing a) is denoted 

|a|, then we have |a| = |a|oH |-|a|(-i, since each edge on a shortest path from the origin to a has one of 

the I colors. 
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Lemma 2.7: The graph of thetessellation {oo, q} with g' > 3 has a shortest-path-invariant addressing scheme 
using q colors. 

Proof: Select an origin and color the q edges incident with the origin with the q colors. Every vertex in 
generation 1 now has just one incident edge (the edge joining it to its parent) colored, and the remaining q — 1 
edges (the edges joining it to its children) can be colored with the remaining q — 1 colors. We may continue 
in this way, coloring the remaining edges of vertices in generations 2, 3, ... in succession, with the q — 1 edges 
joining a given vertex to its children receiving the q — 1 colors distinct from that of the edge joining it to 
its parent. Since there is a unique path between any two vertices in a tree, the shortest-path-invariance is 
satisfied trivially. □ 

Lemma 2.8: Let G be the graph of a tessellation {4, g}, and let a vertex of G be distinguished as the origin. 
Then a coloring of the edges of G that assigns distinct colors to the edges incident with every vertex, and 
assigns the same; color to opposite edges of every face, is a shortcst-path-invariant addressing scheme. 

Proof: Suppose, to obtain a contradiction, that P and Q are two shortest paths from the origin to a vertex 
a in generation g, and that P and Q have different color distributions. We may assume that g >2 is the 
earliest generation for which shortest paths with different color distributions exist. 

The paths P and Q must pass through distinct vertices in generation g—l, since otherwise the common 
vertex & of P and Q in generation g—\ would lie in an earlier generation and the paths P and Q, truncated 
at &, would have different color distributions (since the color distributions of the truncated paths are the 
same as those of P and Q, but each with one fewer occurrence of the color x({a, &})). 

Thus the vertex a must have two parents. Let b and c be the left and right parents of a, respectively, 
and suppose that P passes through b and Q passes through c. Since the parents b and c of a are consecutive, 
the vertices a, b and c lie on a face, and the fourth vertex of this face must be a common parent of both b 
and c in generation g — 2. Let d be this common parent, and let Rhe a shortest path from the origin to 
d. Since b lies in generation g—l, the path P, trimcated at b, must have the same color distribution as the 
path R extended by {b,d}. Similarly, the path Q, truncated at c, must have the same color distribution as 
the path R extended by {c, li}. 

Thus P has the same color distribution as that of the path R extended by {b, d} and {a, b}, and Q has 
the same color distribution as that of the path R extended by {c,d} and {a,c}. But = x{{c,d}) 

and x({a)C}) = x{{b,d}), so P and Q have the same color distribution. This contradiction completes the 
proof. □ 

Lemma 2.9: The tessellation {4, q} with q> 5 has a shortest-path-invariant addressing scheme using q colors. 

Proof: Color an edge incident with the origin 0, then color the remaining edges incident with the origin 
1,2,. — 1 in counterclockwise order. This action colors one edge incident with each vertex in generation 
1. For each vertex in generation 1, color its remaining incident edges with the remaining q — 1 colors 
successively (modulo q) in clockwise order. This action colors either one or two edges incident with each 
vertex in generation 2, and if two edges incident with a vertex have been colored, they will have successive 
colors (modulo q) in counterclockwise order. For each vertex in generation 2, color its remaining incident 
edges with the remaining g' — 1 or g — 2 colors successively (modulo q) in counterclockwise order. Continue 
in this way for generations 3,4, .. . as follows. After all edges incident with vertices in generation g have 
been colored, either one or two edges incident with each vertex in generation g + 1 will have been colored, 
and if two have been colored, they will have successive colors (modulo q) in counterclockwise order ii g + 1 
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is even, and in clockwise order if 51 + 1 is odd. It will then be possible, for each vertex in generation g + 1, 

to color its remaining incident edges with the remaining q ~ 1 or q — 2 colors successively (modulo q) in 
coimtcrclockwise order if 17 + 1 is even, and in clockwise order if 17 + 1 is odd. This procedure assigns distinct 
colors to the edges incident with a given vertex, and (because of the alternation between "clockwise" and 
"counterclockwise" in consecutive generations) it assigns the same color to opposite edges of any face. Thus 
by Lemma 2.8, it yields a shortest-path-invariant addressing scheme. □ 

Lemma 2.10: The tessellation {3, q} with q>7 has a shortest-path-invariant partial addressing scheme using 
q colors. 

Proof: The deletion of all sibling edges from {8,(7} yields a tessellation which we shall denote {3, g}', in 
which the origin has degree q, every vertex other than the origin has degree q — 2 and every face has degree 
4. The edges deleted do not lie on any shortest paths from the origin to any vertex, and thus it will sufHce 
to assign colors to the parent-child edges in {3, g}, which are the edges of {3, g}'. 

To color {3, g}', we begin by coloring {4, q — 2} according to Lemma 2.9. This colored {4, g — 2} may be 
embedded in the plane in a way that is symmetric under the dihedral group of order 2{q — 2) of rotations and 
reflections flxing the origin, so that it is divided by g — 2 "spokes" into q — 2 "sectors" . The spoke s (where 
< s < g — 3) will be a ray from the origin containing the edge from the origin colored s. The origin will not 
belong to any spoke or sector; the edges and all other vertices will be partitioned into sectors. If q is even, 
a spoke will contain one edge directed out of each generation, and one vertex in each generation other than 
the origin. If q is odd, a spoke will contain one edge directed out of each generation congruent to modulo 
3, and one vertex in each generation congruent to or 1 modulo 3. The sector s will comprise all edges and 
vertices other than the origin between spoke s (inclusive) and spoke s + 1 (modulo q — 2, exclusive). 

The tessellation {3, q}' can be obtained from {4, g — 2} by arranging q sectors of {4, q — 2} (compressed 
angularly) around the origin, with new spokes which we shall number q — 2 and g — 1. Thus {3, g}' (apart from 
the origin) is partitioned q sectors, which are numbered through g — 1. with sector s (where < s < g — 1) 
comprising all edges and vertices other than the origin between spoke s (inclusive) and spoke s + 1 (modulo 
g, exclusive). This arrangement can be given a coloring in the following way: color an edge in sector s of 
{3, g}' with color k + s modulo g, where k is the color of the corresponding edge in sector of {4, g — 2}. 

To show that the coloring just described is a shortest-path-invariant partial addressing scheme, it will 
sufBce to verify the hypotheses of Lemma 2.8. These hypotheses constrain the coloring of edges incident 
with a common vertex, or incident with a common face. It is clear that the edges incident with the origin 
receive distinct colors, so it will suffice to consider vertices that lie in a sector. If all the edges incident with 
a vertex or face lie within one sector, then the hypothesis holds automatically, since the coloring of a sector 
in {3, g}' is the same as that of sector in {4, g — 2}, except for a one-to-one renaming of the colors. Thus it 
remains to consider vertices and faces that lie near spokes, in the sense that their incident edges lie in two 
consecutive sectors. It will suffice to consider vertices and faces that lie near spoke 0, since what happens 
near other spokes differs only by a one-to-one renaming of the colors. For a vertex to have some incident 
edges in sector and some in sector g — 1, it must lie on spoke 0. It coloring in {3, g}' differs from its coloring 
in {4, g — 2} only in that some edges that are colored g — 3 in {4, g — 2} are colored g — 1 in {3, g}'. Since 
the color g — 1 is not used in {4, g — 2}, this cannot create a conflict. 

To verify the hypotheses for faces, we consider two cases according to the parity of g. If g = 2r is even, 
then along spoke there is an edge joining each consecutive pair of vertices, and these edges are alternately 
colored and r — 1. The edge on spoke colored 0, have their consecutive edges of their incident faces in 
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sector q—1 colored g — 1, and their opposite edge is colored 0, satisfying the hypothesis. Similarly, the edges 
on spoke colored r — 1, have their consecutive edges of their incident faces in sector q — 1 colored r, and 
their opposite edge is colored r — 1, satisfying the hypothesis. 

If g = 2r + 1 is odd, then along spoke there is a periodic pattern with period six: edges along the spoke 
alternate with faces that straddle the spoke, giving a graph-theoretic period of three (since an edge spans 
one generation, while a face spans two). But since "clockwise" and "counterclockwise" alternate generations, 
the pattern of the coloring repeats only after six generations. The edges that lie along spoke are all colored 
0, their consecutive edges in their incident faces in sector q — 1 are colored q — 1 or 1, and their opposite 
edges are colored 0, satisfying the hypothesis. The faces that straddle spoke each have one pair of opposite 
edges colored r and another pair colored r + 1, again satisfying the hypothesis. □ 

3. Results for Transient Faults 

In this section, we shall establish the results shown in table (1.1) pertaining to transient faults. Specifi- 
cally, we shall show that a tessellation {p, q} cannot tolerate transient faults if g = 2, if g < 4 and p < oo, or 
if g < 6 and p = 3. The tessellation {p, q} can in fact tolerate transient faults in all other cases, but in this 
section, we shall only prove this fact for p = oo and g > 3, for p = 4 and g > 5, and for p = 3 and g > 7, 
because in all the remaining cases, 5 < p < oo, the tessellation can even tolerate combined faults, as will be 
shown in the following section. 

All of our ultimate results concern binary cellular automata that use symmetric majority voting at each 
time step. These automata possess many useful properties. Firstly, they are time-invariant; that is, the 
transition function is unchanged from time step to time step. Secondly, they are homogeneous and isotropic; 
that is, the transition function is the same at each cell, and is unchanged by rotation around a vertex or 
face, or by reflection across an edge (exchanging its two incident faces) or along an edge (exchanging its 
two incident vertices). This property follows from the fact that the automorphism group of the underlying 
tessellation acts transitively on the vertices and oriented edges of its graph (sec Coxcter and Moscr [C2]). 
Finally, the transition function is monotone (changing an input from to 1 cannot change the output from 
1 to 0) and self-dual (complementing all the inputs complements the output). In this section we will also 
need to consider automata ( "sped-up" automata) that do not use symmetric majority voting (but rather use 
an iterated version of it); these automata will, however, possess all the properties just enumerated. But in 
the following section, we will need to consider automata ( "weakened" automata) that are not homogeneous 
or isotropic, and whose transition functions are not self-dual. 

Our main tool for positive results concerning transient faults is Toom's theorem (Theorem 3.2 below). 
As stated by Toom [T2], this theorem does not require time-invariance, montonicity, or self-duality. Our 
statement of it below, however, has been simplified by assuming these properties, which hold in all the cases 
we will consider. It has also been simplified by replacing Toom's definition of transient fault tolerance, which 
involves taking a supremum over a set of probability measures, by the definition given above in Section 1, 
which involves an adversary whose possible actions correspond to the probability measures in that set. 

Let ^ be a monotone and self-dual binary automaton. Since A is self-dual, to determine whether it is 
fault-tolerant it will suffice to consider the case in which it is trying to remember the bit x = 0, so that all 
cells are initially in state 0, and a cell is in error at a particular time if it is in state 1 at that time. The 
level of fault tolerance in this case will then also hold in the dual case x = 1. Since A is monotone, the 



11 



adversary has a simple optimal strategy: take any opportunity provided by a fault to put a cell into state 1 
at a particular time. (This strategy is optimal because following it cannot foreclose any opportunity to put 
any cell into state 1 at any other time.) 

We shall now introduce a graph, the "dependence graph" , that embodies information about the transi- 
tion function of a cellular automaton (as well as about its underlying tessellation) . Let a be a cell in A. We 
shall say that a set S of cells in A is an error set for a if the transition function for a assumes the value 1 
whenever the states of all the cells in S assume the value 1. We shall say that an error set S for a is minimal 
if no proper subset of S is an error set for a. (For a monotone transition function, the minimal error sets 
uniquely determine the transition function, since they correspond to the "min-tcrms" of that function.) We 
shall say that cell a depends on cell b (or that a is a dependent of b) if b belongs to some minimal error set 
for a. We shall define the dependence graph T = (V, H) of A to be the directed graph that has the same set 
of vertices V as the graph G = {V, E) of the underlying tessellation, but that has a directed edge (a, b) £ H 
when and only when a is a dependent of b. If A is the automaton using symmetric majority voting in the 
tessellation {p,q}, then {a,b) € H \f {a, 6} & E, ov \i a — b and q is even. Every vertex in F has both 
in-degree and out-degree both equal to either q ov q+ 1, whichever is odd. 

We shall say that a cell a is a guardian of cell & if 6 is a dependent of a. All of the automata with which 
we shall deal will be "reciprocal" , in the sense that a is a dependent of b if and only if 6 is a dependent of 
a. (The terms "dependent" and "guardian" will thus be equivalent, and we could if we wished use them 
interchangeably, or use one to the exclusion of the other. We shall, however, say that "a is a dependent of 
6" to emphasize that the state of a at time t+1 depends on that of b at time t, and that "a is a guardian 
of 6" to emphasize that the state of b at time t+1 depends on that of a at time t.) 

The negative results of this section use the well known notion of a "self-sustaining island" of errors. A 
self-sustaining island in a tessellation is a finite set / of vertices with the following property: if the cells at 
vertices in / are in error at some time t^, while all other cells are not in error, then the cells in / will remain 
in error for all times t > to (because each cell in I has a majority of its guardians also in 7). Clearly, if a 
homogeneous and monotone cellular automaton has a self-sustaining island, then it cannot tolerate transient 
errors. For by homogeneity, every cell is contained in a translated version of that island. Sooner or later, 
every cell of that version will suffer a fault simultaneously, and from that time on, every cell of the version 
will remain in error. Thus, every cell of the tessellation is eventually in error, and remains in error for all 
subsequent time. 

If q = 2, we may take any two adjacent vertices as a self-sustaining island: each vertex of the island has 
a neighbor in the island and this, together with the vertex itself, gives the required majority of two out of 
three votes to keep the island in error. 

If 3 < g < 4 and p < oo, we may take the p vertices around a face as a self-sustaining island: each 
vertex has two neighbors in the island and thee neighbors, together with the vertex itself if g = 4, give the 
required two out of three, or three out of five if g = 4, votes required to keep the island in error. 

Finally, if 5 < g < 6 and p = 3, we may take a vertex together with its q neighbors as a self-sustaining 
island: each vertex now has three at least neighbors in this island, and these neighbors, together with the 
vertex itself if q = 6, give the required three out of five, or four out of seven if g = 6, votes required to keep 
the island in error. These arguments yield the following theorem. 
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Theorem 3.1: The tessellation {p, q) cannot tolerate transient faults if g = 2, if g < 4 and p < oo, or if g < 6 
and p = 3. 

We shall now introduce a graph, the "extended dependence graph", that embodies temporal as well 
as spatial relationships among the states of various cells at various times. We shall define the extended 
dependence graph of A to be the directed graph F* = {y*,H*) that has as its set of nodes V* = V x'H 
(where N = {0, 1,2, . . .} denotes the set of natural numbers), and directed arcs {{a,s),{b,t)) e H* when 
and only when (a, b) £ H and s = t + l (that is, when the state of cell a at time s depends directly on that 
of cell b at time t). We shall say that a set S* of nodes in T* is an error set (respectively, minimal error set) 
for the node (a, t + 1) if S* = S x {t}, where the set of vertices S in F is an error set (respectively, minimal 
error set) for a. 

Our positive results on transient fault tolerance will all use the following theorem. 

Theorem 3.2: (A. L. Toom, 1980, [T2]) Let F* = {V'\H*) be the extended dependence graph of a time- 
invariant, monotone and self-dual binary cellular automaton A. Suppose that for some n there exist n 
functions L\,L-2, . . . ,Ln ■ V* — > R ( where R denotes the set of real numbers) that satisfy the following 
three conditions. 

(1) There exists a constant M such that, for every arc (a, b) G H* and every A; (1 < fc < n), \Lk{b) — Lk{a)\ < 
M. 

(2) For every a G V*, Ei<fe<„ ^fc(a) = 0. 

(3) For every a £V*, every error set S* C V* for a and every fc (1 < fc < n), there exists b G S* such that 
Lk{b) - Lk{a) > 1. 

Then A tolerates transient faults. Indeed, if the fault rate is e > 0, the probability that a particular cell is 
in error at a particular time is 0(e). 

Lemma 3.3: Let A be a cellular automaton with a shortest-path-invariant addressing scheme using I colors. 
Suppose that for every vertex a in ^ and for every error-set S for a, (i) there is a vertex b € S with 
\b\ > \a\ + 1, and (ii) for each color fc € {0, ... ,Z — 1}, there is a vertex bk & S with \bk\k < |a|fe- Then A 

tolerates transient faults. 

Proof: We shall apply Theorem 3.2 to F* with n = I + 1. Given a node (a, t) in F* and fc G {0, . . . , / - 1}, 
we define 

Lk+i{{a,t)) = -{I + l)\a\k - t, 

and 

Li+i{{a,t)) ={l + l)\a\+lt. 

Since | • • • | and each | • • • |fe change by at most 1 when proceeding from a vertex in G to one of its neighbors, 
it is clear that Condition (1) of Theorem 3.2 is satisfied with M = I + 2. Condition (2) is verified by the 
identity \a\ = \a\o H h It remains to verify Condition (3). 

Given vertex a, an error-set S for a, and a color fc e {0, . . . , Z — 1}, we can find by hypothesis (ii) a 
vertex bk & S such that \bk\k < |a|fe- We then have 

Lk+i{{bk,t)) = -{I + l)\bk\ - t 
> -(Z + l)|a| -i 
= Lfe+i((a,t+l)) +1, 
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which verifies Condition 3 for For L„, we have by hypothesis (i) a vertex b G S such that 

|6| > \a\ + 1. We then have 

Li+i{{b,t)) = il + l)\b\+lt 

> {I + l)\a\ + {I + 1) + It 
= {I + l)\a\ + l{t + 1) + 1 
= Li+i{{a,t + l)) +1, 
which completes the verification of Condition 3. □ 

For the positive results in this section, we shall begin with the simplest case, that of trees. 
Proposition 3.4: For q > 3 the tessellation {oo, q} tolerates transient faults. 

Proof: By Lemma 2.7, the tessellation {oo, q} has a shortest-path-invariant addressing scheme using q colors, 
which we shall use to apply Lemma 3.3. 

Consider a vertex a in the graph of {oo, q} and an error-set S for a. We claim that S must contain at 
least two neighbors of a (that is, guardians of a distinct from a itself). If g = 2r + 1 is odd, then S must 
contain at least r + 1 guardians (which, since q is odd, are also neighbors) of a, and since g > 3, we have 
r + 1 > 2, verifying the claim for odd g > 3. If g = 2r is even, then S must again contain contain r + 1 
guardians of a (all but at most one of which are neighbors), and since q > 4, we have r > 2, verifying the 
claim for even q > 4. 

We may now verify the hypotheses of Lemma 3.3. We have at least two neighbors of a in S. At most 
one of these neighbors can be the parent of a, so at least one such neighbor b must be a child of a and thus 
must satisfy b G S with |6| > \a\ + 1. For k G {0, . . . , Z — 1}, only one of the neighbors of a can be joined 
to a by an edge colored k, so at least one neighbor bk must satisfy \bk\k < Thus Lemma 3.3 applies, 
completing the proof of the proposition. □ 

Next we turn to the case p = 4, with q > 5. 

Proposition 3.5: For g > 5 the tessellation {4, g} tolerates transient faults. 

Proof: By Lemma 2.9, the tessellation {4,^} has a shortest-path-invariant addressing scheme using q colors, 
which we shall use to apply Lemma 3.3. 

Consider a vertex a in the graph of {4, q] and an error-set S for a. We claim that S must contain at 
least three neighbors of a. If g = 2r + 1 is odd, then S must contain at least r + 1 guardians (which, since 
q is odd, are also neighbors) of a, and since g > 5, we have r -|- 1 > 3, verifying the claim for odd g > 5. If 
g = 2r is even, then S must again contain contain r + 1 guardians of a (all but at most one of which are 
neighbors), and since g > 6, we have r > 3, verifying the claim for even g > 4. 

We may now verify the hypotheses of Lemma 3.3. We have at least three neighbors of a in S. At most 
two of these neighbors can be parents of a, so at least one such neighbor b must be a child of a and thus 
must satisfy b E S with |5| > \a\ + 1. For k G {0, . . . ,1 — 1}, only one of the neighbors of a can be joined 
to a by an edge colored k, so at least one neighbor bk must satisfy \bk\k < \a\k- Thus Lemma 3.3 applies, 
completing the proof of the proposition. □ 

For the cases with p = 3, the application of Toom's theorem presents a new difficulty. In the applications 
for p = 00 and p = 4, an error at the origin was eventually corrected because each cell eventually received 
correct information from its children. Consider, however, the automaton with symmetric majority voting on 
{3, 7}. For the cells with two parents as well as two siblings, these four neighbors constitute a majority of the 



14 



seven votes that determine the next state. Thus such cells may remain in an erroneous state in spite of all 

their children being in the correct state. This situation is rescued by the fact that, according to Lemma 2.2, 
two such cells cannot be siblings of each other; that is, of any two siblings, at least one miist be a single-parent 
cell that cannot be led into error unless at least one of its children is in error. This circumstance, however, 
means that it may take two time steps for an error in a two-parent cell to be corrected by information from 
a "niece" or "nephew" (a child of a sibling). 

Our strategy for p = 3 will thus be as follows. Let A be the symmetric majority voting automaton on 
the tessellation {3, q} with q > 7. We shall consider a "sped-up" version of the symmetric majority voting 
automaton A: the transition function of A^ will accomplish in one time step what the transition function of 
A accomplishes in two time steps. Transferring attention to A'^ is equivalent to assuming that faiilts occur 
only at every second time step. We shall then prove Lemma 3.6, a generalization of Lemma 3.3 that will 
allow us to deduce from a shortest-path-invariant partial addressing scheme for A the conclusion that A'^ 
tolerates transient faults. Lemma 2.10 provides a shortest-path-invariant partial addressing scheme for A, 
allowing us to conclude in Lemma 3.7 that tolerates transient faults. In Lemma 3.8 we shall show that 
if A"^ tolerates transient faults, then so does A, allowing us to conclude in Proposition 3.9 that A tolerates 
transient faults. 

The strategy just described applies to situations in which the speed-up is by a factor greater than two, 
and in which the transition function of A is not necessarily symmetric majority voting. We shall therefore 
prove Lemmas 3.6 and 3.8 in greater generality than we need in this paper, in the hope that they will find 
further applications. 

If A is a time-invariant cellular automaton, its K-fold speed-up A'^ (where k > 2 is an integer) is the 
the cellular automaton (with the same cells and the same set of states for each cell) whose state transition 
function does in one time step what that of A does in k time steps. If A is monotone and self-dual, then so 
is A'^. 

Lemma 3.6: Let A be a time- invariant, monotone and self-dual binary cellular automaton with a shortest- 
path-invariant partial addressing scheme using I colors. Let B = A'^ he the K-fold speed-up of A. Suppose 
that for every vertex a in B and for every error-set 5 for a in B, (i) there is a vertex h & S with |6| > |a| + 1, 
and (ii) for each color k G {0, — 1}, there is a vertex bk & S with \bk\k < \(i\k- (Here | • • • | and | • • • |fe 
refer to path lengths in A and the shortest-path- invariant partial addressing scheme of ^4.) Then B tolerates 
transient faults. 

Proof: Let A = (V,K) be the dependence graph of B, and let A* = (V*,K*) be the extended dependence 
graph of B. We shall apply Theorem 3.2 to A* with n = l + l. Given a node (a, t) in A* and k G {0, ... ,1 — 1}, 
we define 

Lk+i{{a,t)) = -{l + l)\a\k -t, 

and 

Li+i{{a,t)) = {l + l)\a\ + lt. 

Since | • • • | and each | • • ■ |fe change by at most k when proceeding from a vertex in A to one of its neighbors, 
it is clear that Condition (1) of Theorem 3.2 is satisfied with M = k{1 + 2). Condition (2) is verified by the 
identity \a\ = \a\o H h |a|;_i. It remains to verify Condition 3. 
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Given vertex a, an error-set S in B for a, and a color k £ {0, ... ,1 — 1}, we can find by hypothesis (ii) 
a vertex bk & S such that |6fe|fe < \a\k. We then have 

Lk+i{{bk,t)) = -{l + l)\bk\-t 

> -{l + l)\a\-t 

= -{l + l)\a\-{t+l) + l 
= Lk+i{{a,t + l))+l, 

which verifies Condition 3 for Li,. . . For L„, we have by hypothesis (i) a vertex b ^ S such that 

|6| > \a\ + 1. We then have 

Li+i{{b,t)) = {l + l)\b\ + lt 

> (Z + l)|a| + (/ + l) + /i 
= (Z + l)|a| + /(i+l) + l 
= Li+i{{a,t + 

which completes the verification of Condition 3. □ 

Lemma 3.7: Let A be the binary automaton using symmetric majority voting on {3,q} with q>7, and let 
B = A^. Then B tolerates transient faults. 

Proof: By Lemma 2.10, A has a shortest-path-invariant partial addressing scheme using q colors. We shall 
apply Lemma 3.6 with I = q and k = 2. 

Consider a vertex a and an error-set S for a in B. There must exist an error-set T for a in A, and for 
each vertex c in T, must include an error-set for c in A. We claim that T must contain at least four 
guardians (which, since q is odd, are neighbors) of a. If g = 2r + 1 is odd, then T must contain at least r + 1 
neighbors of a, and since q>7,we have s -|- 1 > 4, verifying the claim for odd q>7. If g = 2r is even, then 
T must again contain contain r + 1 guardians of a (all but at most one of which are neighbors), and since 
q > 8, we have s > 4, verifying the claim for even g > 6. By a similar argument, for each c G T, Sc must 
contain at least four neighbors of c. 

We may now verify the hypotheses of Lemma 3.6. To satisfy condition (i), we must take a step from 
a to a neighbor b G S of a in B such that |6| > \a\ + 1. To do this we shall take two steps in A, the first 
from a to a neighbor c G T of a in ^, and the second from c to a neighbor 6 e of c in A. At each step 
we shall move from a vertex to a child of that vertex if possible, and to a sibling of that vertex if no move 
to a child is possible; it will never be necessary to move to a parent. If a vertex has just one parent, then 
at most three of the neighbors in an error-set for that vertex are parents or siblings, and thus a move to a 
child must be possible. Only if a vertex has two parents can all four of the neighbors in an error-set for that 
vertex be parents or siblings, forcing a move to a sibling. 

By Lemma 2.2, two consecutive vertices in a generation cannot both be two-parent vertices. Thus, of 
the two steps to neighbors in A, neither can be to a parent, and at least one must be to a child, since two 
consecutive steps to siblings could only occur from two consecutive two-parent vertices in a generation, which 
is impossible. It follows that neither step decreases the norm | • • ■ [, and at least one of the steps increases it 
by 1. Thus these steps arrive at a vertex b € S with |6| > \a\ + 1. 

To satisfy condition (ii) for a given k G {0, . . . ,1 ~ 1}, we must take a step from a to a neighbor 6 G 5 
of a in i? such that \b\k < \a\k. To do this we shall again take two steps in A, the first from a to a neighbor 
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c € T oi a in A, and the second from c to a neighbor 6 G of c in A. We shall show that it is always 
possible to take such a step in a safe way, that is, without increasing the fc-th norm | ■ • ■ |fe. Of the four 
or more neighbors in an error-set for a vertex, at most one can be a child with greater fc-th norm (a child 
connected by an edge with color k), and at most two can be siblings. Thus at least one of the neighbors in an 
error-set must be either a parent or a child with no greater fc-th norm, to which a safe move is possible. This 
completes the verification of hypothesis (ii) of Lemma 3.6, and thus completes the proof of the proposition. 
□ 

Lemma 3.8: Let A be a time- invariant, homogeneous and monotone binary cellular automaton, and let 
B = A'^ be its K-fold speed-up. Then if B tolerates transient faults, so does A. 

Proof: We shall construct a coupling between the probability space of A and that of B. That is, we shall 
define on a common probability space a copy of the probability space of A and a copy of the probability 
space of B. This construction will be such that whenever the faults in A are such as to allow the adversary 
to force a cell u at a time nt {t> 1) into error, the faults in B will allow the adversary to force the cell v at 
time t into error. It will follow by induction on t that the errors in A at time nt are stochastically dominated 
by those in B at time t. Since the probability of error at a cell in a monotone binary cellular automaton is a 
non-decreasing function of time, it will follow that the supremum of the probability of error in A over time 
is bounded by that of B, so that if B tolerates transient faults, then A does as well. 

Let r = {V,H) denote the dependence graph of A. Let = {V,Hi^) denote the directed graph that 
has the same set of vertices V as P, but that has a directed edge {v, w) € H^, when and only when there is 
a path of length at most k from t; to t« in F. Since A is homogeneous, every vertex has the same in-degree 
and out-degree in F„. Let A denote this common in- and out-degree. 



Let X^y^yj^^t for {v,w) G and t > be independent Bernoulli random variables with Pr[X(^ ,„) ^ = 
1] = ^. Define Y^^t for v e V and i > by 



Since the Yy^t are defined from disjoint sets of independent random variables, they are independent Bernoulli 
random variables with Pr[y„^t = 1] = ry, where rj = We may thus take Y^^t to be the indicator of a fault 
at cell V at time t in automaton A, with fault rate r/. Define Z^,s iov w & V and s > by 



Since the Z^j^g are defined from disjoint sets of independent random variables, they are independent Bernoulli 
random variables with Pr[Z^,s = 1] = ^, where ^ = 1 — (1 — ^)'^^. We may thus take Z^^g to be the indicator 
of a fault at cell v at time nt in automaton B, with fault rate C,. 

Now if in automaton A no faults occur at cell v or any cell with in distance k of t; at any time in the 
interval [nt,K{t — 1)], then the state of cell v at time nt will be the same function the states of the cells 
within distance k of w at time K{t — 1) as the transition function for automaton B. But if in automaton A 
any fault occurs at cell v or any cell with in distance fc of w at any time in the interval [nt^ K,{t — 1)], then a 
fault will occur at cell v at time t in automaton B. It follows that the errors in automaton A at time nt are 
stochastically dominated by those in automaton B at time t. Thus if C, is sufficiently small that B tolerates 







(.,,™)6ff„ 
0<M<«-1 
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transient faults, the corresponding value of rj = (l — (1 — (y/'^^'^ will be sufficiently small that A tolerates 
transient faults. □ 

Lemma 3.7 and Lemma 3.8 together prove the following proposition. 

Proposition 3.9: For g > 7 the tessellation {3,g} tolerates transient faults. 

Propositions 3.4, 3.5 and 3.9 together prove the following theorem. 

Theorem 3.10: The tessellation {p, q} tolerates transient faults if p = oo and g > 3, if p = 4 and g > 5, or if 
j3 = 3 and q>7. 

4. Results for Combined Faults 

In this section, we shall establish the results shown in Table (1.1) pertaining to combined faults. Specif- 
ically, we shall show that a tessellation {p, q} can tolerate combined faults if p > 5 and g > 5, if p = 4 and 
g > 7, or if p = 3 and g > 9. The tessellation {p, q} cannot in fact tolerate combined faults in any other 
cases, but in this section we shall only prove this for p = oo and 3 < g < 4, for p = 4 and 5 < g < 6, and 
for p = 3 and 7 < g < 8, because in all the remaining cases the tessellation cannot even tolerate transient 
faults, as was shown in the preceding section. 

For the negative results of this section, we shall introduce the notion of a "pier-supported bridge" . A 
pier- supported bridge in a tessellation is a pair (/, J) of finite sets of vertices, where / is called the bridge 
and J is called the set of piers, with the following property: if the cells at the vertices in J are in error 
for all time, and the cells at the vertices in I are in error at some time to, then the cells in I will remain 
in error for all time t > to (because each cell in I has at least one-half of its guardians in 7 U J). If the 
piers of a pier-supported bridge all suffer permanent faults, then eventually all the cells of the bridge will 
simultaneously suffer transient faults, and from that time onward all cells in the bridge and its piers will be 
in error. Let v be a cell in a tessellation G. If with probability 1 there exists a pier-supported bridge whose 
piers all suffer permanent failures and whose bridge contains v, then G docs not tolerate combined faults. 

Suppose first that p — oo and 3 < g < 4. Let vq be a cell, and let . . . ,V-i,vo,vi, . . . be an indexing 
of the vertices around a face including vq such that Vk and Vk+i are joined by an edge for all k G Z. Then 
for any m > 1 and n > 1, {Im,n,Jm,n), where Im,n = {v- (m— 1) ; • • • ? "^n— 

i} and Jto,„ = {v-m,Vn}, form a 

pier-supported bridge, since each vertex in I has two neighbors (plus itself, if g = 4) in Im,n U Jm,n- With 
probability 1, there exists an m > 1 such that w_m suffers a permanent failure, since this event is the union 
of countably many independent events, each of which occurs with the same strictly positive probability. 
Similarly, with probability 1 there exists an n > 1 such that Vn suffers a permanent failure. Since these 
two events each occur with probability 1, their intersection also occurs with probability 1. For this m and 
n, {Im,n,Jm,n) then forms a pier-supported bridge, and thus tessellations with 3 < g < 4 do not tolerate 
combined faults. 

For the following we shall need the notion of a an "opposite-edge set" . If e is an edge in a tessellation in 
which every face has degree four, the opposite-edge set containing e is the smallest set F of edges such that 
{!) e E F and (2) li f € F and g is the edge opposite e on either of the faces bounded by /, then g G F. 

Suppose next that p = 4 and 5 < g < 6. Let vo be a cell, let eo be an edge containing vo, and let 
F be the opposite-edge set containing eg. If -F were finite, the vertices bounding the edges contained in F 
would constitute a self-sustaining island, and the tessellation would not even tolerate transient errors. (This 
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case cannot arise, since it would contradict Proposition 3.5.) Thus we may assume that F is infinite. Let 

. . . , e_i, Co, ei, ... be an indexing of the edges in F such that ek and ek+i are opposite edges of a face for all 
k eZ. Then for any m > 1 and n > 1, Jm,„), where Im,„ = e_(„j_i) U- • - Uen-i and J„^„ = e_mUe„, 

form a pier-supported bridge, since each vertex in / has three neighbors (plus itself, if g = 6) in Im,n U Jm,n- 
With probability 1, there exists an m > 1 such that both vertices of e_m suffer permanent failures, since 
this event is the union of countably many independent events, each of which occurs with the same strictly 
positive probability. Similarly, with probability 1 there exists an n > 1 such that both vertices of e„ suffer 
permanent failures. Since these two events each occur with probability 1, their intersection also occurs with 
probability 1. For this m and n, {Im.n, Jm.n) then forms a pier-supported bridge, and thus tessellations with 
p = 4 and 5 < < 6 do not tolerate combined faults. 

Suppose finally that p = 2> and 7 < g < 8. Let vq be a vertex in {3, q] We consider the tessellation 
{3, q}' , obtained from {3, q} by deleting all sibling edges with respect to the origin vq. Every face of {3, q}' 
has degree four, so the argument of the previous paragraph shows that with probability 1, there is a pier- 
supported bridge (/, J) with Vq € I and permanent faults at every vertex in J. Thus the tessellations with 
p = 3 and 7 < (j < 8 do not tolerate combined faults. These arguments yield the following theorem. 

Theorem J^.l: The tessellation {p, q} cannot tolerate combined faults if p = oo and 3<g<4, ifp = 4 and 
5 < g < 6, or if p = 3 and 7 < q < 8. 

All of our positive results in Section 2 were derived from Toom's theorem (Theorem 3.2). That theorem 
applies to transient faults, but not to combined faults. We shall next prove an analogous theorem that 
applies to combined faults. 

Let A be a binary cellular automaton using symmetric majority voting. Because majority voting is 
self-dual, we may assume without loss of generality that A is trying to remember the bit 0, so that all cells 
are initially in state 0. A cell is in error if it is in state 1, and because majority voting is monotone, the 
optimal strategy for the adversary is to take any opportunity to put any cell in state 1. 

To show that a cellular automaton A with majority voting tolerates combined faults, we shall use a 
monotone binary automaton B that will be called a weakening of A. The automaton B will be obtained 
from A by specifying, for each cell a in A, a set /(a) of guardians of a to be ignored. The cells of B will 
be the same as the cells of A, but the transition function of a cell a in B will be obtained from that of the 
cell a in A by substituting 1 for each argument corresponding to an ignored cell in I [a). Because of the 
monotonicity of the transition functions, for any disposition of permanent and transient faults in space and 
time, the errors in B will stochastically dominate the errors at corresponding places and times in A. Thus 
the probability that cell a of A is in error at time t is at most the probability that cell a of is in error at 
time t. 

The transition function for a cell in ^4 is a threshold function, which assrunes the value 1 if the nimiber 
of Is among its arguments exceeds a certain number called the threshold of the cell. (For majority voting, 
the threshold of every cell is r -|- 1 if the cell has 2r -|- 1 guardians, that is, if it has an even number 2r or 
an odd number 2r + 1 of neighbors.) The transition fimction for a cell in B is also a threshold function, 
whose threshold, called the reduced threshold, is obtained by reducing the original threshold by the number 
of vertices ignored by the cell. 

To bound the probability that cell a of 5 is in error at time t, we shall consider a particular disposition 
of permanent and transient faults in space and time for which cell a is in error at time t, and construct a 
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graph S* = {X* UY*,Z*) called the extended explanation graph rooted at cell a at time t, which will be a 

finite subgraph of the extended dependence graph of A* = {V* , K*) of B. The set X* U Y* of nodes of S* 
is partitioned into two disjoint subsets, X* n F* = 0: the nodes in X* will be called terminal nodes, while 
those in Y* will be called non-terminal nodes. 

We shall define the extended explanation graph S* by giving an algorithm for constructing it. This 
algorithm will work in a breadth-first fashion, and will maintain a queue of nodes, which will initially be 
empty. If a node (6, s) appears in the queue at any time during the execution of the algorithm, the cell b is 
in error at time s. The sets X*, Y* and Z* will be regarded as variables that are initially empty, that may 
have elements added to them from time to time, and whose final values will define the extended explanation 
graph S* . 

(1) Put the node (a, t) into the queue. 

(2) While the queue is non-empty, perform the following sequence of steps until instructed to stop. 

(2.1) Dequeue a node (6, s) from the queue. 

(2.2) If X* U Y* currently contains a node (6, r) for any s < r < t, stop. 

(2.3) If the cell b is at fault at time s (either because of a transient fault at b at time s, or because of a 
permanent fault at b), put the node {b,s) into X* (so that {b,s) becomes a terminal node); then 
stop. 

(2.4) Put the node (b, s) into Y* (so that (5, s) becomes a non-terminal node). Since the cell b is in error, 
but not at fault, at time s, there must exist an error set S* for (6, s) in A* such that (i) the number 
of nodes in S* is at least the reduced threshold of b, and (ii) for each node (c, r) in 5* , s = r + 1 
and the cell c is in error at time r. For each node (c, r) in S*, put the arc ((6, s), (c, r)) into Z* and 
put the node (c, r) into the queue; then stop. 

It is clear that a cell b can appear in a node (6, s) in X*{JY* for at most one value of s, and that a node 
{b, s) can appear in X* or Y* but not both. The out-degree of a terminal node is zero, and the out-degree 
of a non-terminal node {b, s) is a least the reduced threshold of b. 

Prom the extended explanation graph S* just constructed, we shall construct the explanation graph 
S = {X L)Y,Z), which is a finite subgraph of the dependency graph A = {V,K) of B, by "projecting out 
the time": The graph S contains a terminal vertex b if S* contains a terminal node (&, s) for any time s, 
contains a non-terminal vertex b if S* contains a non-terminal node [b, s) for any time s, and contains an 
edge (6, c) if X* contains an edge ((6, s), (c, r)) for any times s and r. It is clear that a vertex can appear 
in X or Y, but not both. The out-degree of a terminal vertex is zero, and the out-degree of a non-terminal 
vertex 6 is a least the reduced threshold of b. 

The construction of S* identifies for each terminal vertex 6 of S a particular time (the time s for which 
(6, s) is a node in 5*) at which b is at fault. The probability that a particular cell is at fault at a particular 
time is at most £ = 1 — (1 — a){l — (3), and these probabilities are independent for distinct cells. Thus the 
probability that a particular subgraph S of the dependency graph A of i? is the explanation graph for a cell 
a that is in error at time t is at most £™, where m is the number of terminal vertices in S. 

An explanation graph rooted at a and containing n vertices is an acyclic directed graph with source a, 
and thus can be described by the sequence of edge traversals in a depth-first search. Each vertex has total 



20 



degree (in-degree plus out-degree) at most q, so if there are n vertices, there are at most 2qn edge traversals 
in the sequence. Thus there are at most 

y q^ = ^ Zi<g2«„+1 

^ q — 1 

\<k<2qn ^ 

possible explanation graphs rooted at a and having n vertices. 

Theorem 4 -2: Let A be a time-invariant monotone binary automaton. Suppose that for each cell a in A 
there exists a weakening B oi A such that there exists a constant M such that, for every explanation graph 
5 rooted at a, the total number of vertices in S is at most M times the number of terminal vertices in S. 
Then A tolerates combined faults. 

Proof: If cell a is in error at some time t, faults must occur corresponding to the terminal vertices of an 
explanation graph rooted at a at time t. Since there are at most g^gn+i possible explanation graphs with n 
vertices, there are at most g2gMm+i possible explanation graphs with m terminals. Thus we have 

Pr[a in error at time t]<qY^ q2qMm^m 

m>l 

- l-q^iM^- 

This bound tends to zero as 0{e) as e tends to zero, which completes the proof. □ 

We shall apply Theorem 4.2 in a sequence of results of increasing intricacy. Our applications of Theorem 
4.2 will use a "balance of payments" argument of the following form. We start by putting a certain positive 
amount of money on each non-terminal vertex of the explanation graph, but no money on terminal vertices. 
We shall then move a certain amount of money across each edge, taking it from the source vertex of the 
edge and giving it to the target vertex. These movements will be chosen so as to leave no money on any 
non-terminal vertex, so that (since money is conserved in the movements) all the money is now on the 
terminal vertices. If r is a lower bound to the amount of money initially on any non-terminal vertex, and s is 
an upper bound to the amount of money on any terminal vertex, then r times the number of non-terminals 
is at most s times the number of terminals. Thus we may take M = l + s/rin Theorem 4.2. 

Our applications of the balance of payments argument will use an initial distribution of money deter- 
mined in the following way. We will associate with each edge in the explanation graph a certain amount of 
money to be moved across it. We then put on each non-terminal vertex the sum of the amounts associated 
with the edges directed out of the vertex, minus the sum of the amounts associated with the edges directed 
into the vertex. This rule ensures that after the movement of funds across edges, each non-terminal is left 
with no money. 

Proposition 4-3: For q>5, the tessellation {oo,g} tolerates combined faults. 

Proof: For g > 5, let A be the cellular automaton based on the tessellation {oo.q} with symmetric majority 
voting. Let a be a cell in A, and take a as the origin of the tessellation. Wc define the weakened automaton 
B by having each cell b ignore (1) its parent (unless b is the origin) and (2) itself (if q is even). Since q is at 
least 5 (6 if g is even), the threshold of each vertex is at least 3 (4 if g is even). Thus the reduced threshold 
of each vertex is at least 2. 

The explanation graph is a finite tree with a as its root and with the terminal vertices as its leaves. We 
associate a fiow of 1 dollar with each edge. Every non-terminal has in-degree at most 1 (from its parent), 
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and out-degree at least 2 (its reduced threshold), and thus initially has at least 1 dollar. Every terminal has 

in-degree at most 1, and thus finally has at most 1 dollar. We conclude that the number of terminals is at 
least the number of non-terminals, and thus that we may take M=l + l/l = 2in Theorem 4.2. □ 

Proposition 4.4: For (j > 7, the tessellation {4,(7} tolerates combined faults. 

Proof: For q >7, let A be the cellular automaton based on the tessellation {4,<7} with symmetric majority 
voting. Let a be a cell in A, and take a as the origin of the tessellation. We define the weakened automaton 
B by having each cell b ignore (1) its parent or parents (unless b is the origin) and (2) itself (if q is even). 
Since q is at least 7 (8 if g is even), the threshold of each vertex is at least 4 (5 if g is even). Thus the reduced 
threshold of each one-parent vertex is at least 3, and the reduced threshold of each two-parent vertex is at 
least 2. If we were to associate a flow of 1 dollar with each edge, two-parent non-terminal vertices could 
have both in- flow 2 (from their parents) and out-flow 2 (their reduced thresholds), and thus initially have 
dollars. To ensure that every non-terminal initially has strictly positive funds, we shall distinguish two types 
of edges in the explanation graph, with different flows for each type. 

Say that an edge is special if it is directed from a one-parent parent to a two-parent child. We associate 
a flow of 1 dollar with each special edge, and a flow of 3 dollars with each other edge. 

A one-parent vertex has in-flow at most 3 (from its parent), since an in-edge to a one-parent vertex 
cannot be special. It has out-degree at least 3 (its reduced threshold). Of these out-edges, at most two can 
be special (since only a leftmost or rightmost out-edge can be special), so the outflow is at least 1-1-1 + 3 = 5. 
Thus every one-parent vertex initially has at least 5 — 3 = 2 dollars. 

A two-parent vertex has in-degree 2 (from its parents), but at least one of these parents must be a 
one-parent vertex (two two-parent parents would be consecutive, with no intervening one-parent vertices, 
contradicting Lemma 2.1). Thus the in-flow is at most 1 + 3 = 4. It has out-degree at least 2 (its reduced 
threshold), and thus its out-flow is at least 3 + 3 = 6 (since an out-edge from a two-parent vertex cannot be 
special). Thus every two-parent vertex initially has at least 6 — 4 = 2 dollars. 

A terminal vertex can have in-dcgrcc at most 2, thus in-flow at most 3 + 3 = 6, and thus finally at most 
6 dollars. We conclude that 6 times the number of terminals is at least 2 times the number of non-terminals, 
and thus that we may take M = 1 + 6/2 = 4 in Theorem 4.2. □ 

Proposition 4-5: For q>9, the tessellation {3,(7} tolerates combined faults. 

Proof: For q > 9, let A be the cellular automaton based on the tessellation {3, q} with symmetric majority 
voting. Let a be a cell in A, and take a as the origin of the tessellation. We define the weakened automaton 
B by having each cell b ignore (1) its parent or parents (unless b is the origin), (2) its siblings (if it is a 
one-parent vertex), and (3) itself (if q is even). Since q is at least 9 (10 if q is even), the threshold of each 
vertex is at least 5 (6 if g is even). Thus the reduced threshold of each one-parent vertex is at least 2, and 
the reduced threshold of each two-parent vertex is at least 3. 

We associate a flow of 2 dollars with each sibling edge, and a flow of 3 dollars with each other edge. 
Of the two siblings of a one-parent vertex, at least one must be another one-parent vertex (since otherwise 
there would be two two-parent vertices with only one intervening one-parent vertex, contradicting Lemma 
2.2). Thus a one-parent vertex can have at most one sibling in-edge. Its total in-flow is thus 3 (from its 
parent) plus at most 2 (from a sibling), for a total of 5. Its out-degree is at least 2 (its reduced threshold), 
so its out-flow is at least 3 + 3 = 6. Thus every one-parent vertex initially has at least 6 — 5 = 1 dollar. 
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A two-parent vertex has in-dcgrcc 2 (from its parents), and thus has in-flow 3 + 3 = 6. It has out-degree 

at least 3 (its reduced threshold). At most 2 of these out-edges can be sibling edges, so its out-flow is at 
least 2 + 2 + 3 = 7. Thus every 2-parcnt vertex initially has at least 7 — 6 = 1 dollar. 

A terminal vertex can have in-degree at most 2, thus in-flow at most 3 + 3 = 6, and thus finally at most 
6 dollars. We conclude that 6 times the number of terminals is at least the number of non-terminals, and 
thus that we may take M=l + 6/l = 7in Theorem 4.2. □ 

Proposition 4-6: For even p> 6 and q>5, the tessellation {p, q} tolerates combined faults. 

Proof: For even p > 6 and q > 5, let A be the cellular automaton based on the tessellation {p, q} with 

symmetric majority voting. Let a be a cell in A, and take a as the origin of the tessellation. We define the 

weakened automaton B by having each cell b ignore (1) its parent or parents (\mless b is the origin) and (2) 
itself (if q is even). Since q is at least 5 {6 ii q is even), the threshold of each vertex is at least 3 (4 if g is 
even). Thus the reduced threshold of each one-parent vertex is at least 2, and the reduced threshold of each 
two-parent vertex is at least 1. 

Say that an edge is special if it is directed from a one-parent parent to a two-parent child. We associate 
a flow of 1 dollar with each special edge, and a flow of 3 dollars with each other edge. 

A one-parent vertex has in-flow at most 3 (from its parent), since an in-edge to a one-parent vertex 
cannot be special. It has out-degree at least 2 (its reduced threshold). Of these out-edges, at most one can 
be special (by Lemma 2.4), so the outflow is at least 1 + 3 = 4. Thus every one-parent vertex initially has 
at least 4 — 3 = 1 dollar. 

A two-parent vertex has in-degree 2 (from its parents), and both of these parents must be one-parent 
vertices (by Lemma 2.5). Thus the in-flow is at most 1 + 1 = 2. It has out-degree at least 1 (its reduced 
threshold), and thus its out-flow is at least 3 (since an out-edge from a 2-parent vertex cannot be special). 
Thus every two-parent vertex initially has at least 3 — 2 = 1 dollar. 

A terminal vertex can have in-degree 1, in which case the in-flow is 3, or in-degree 2, in which case the 
in-flow is 1 + 1 = 2. Thus each terminal vertex flnally has at most 3 dollars. We conclude that 3 times the 
number of terminals is at least the number of non- terminals, and thus that we may take M = 1 + 3/1 = 4 
in Theorem 4.2. □ 

Proposition 4-7: For odd p > 5 and 9 > 5, the tessellation {p, q} tolerates combined faults. 

Proof: For odd p > 5 and q > 5. let A be the cellular automaton based on the tessellation {p, q} with 
symmetric majority voting. Let a be a cell in A, and take a as the origin of the tessellation. Our definition 
of the weakened automaton B will be more complicated than that for previous propositions, in that the 
neighbors of a vertex to be ignored will not be determined merely by the type (cousin, non-cousin one- 
parent, or two-parent) of that vertex. Instead, we shall classify vertices as weak or strong, proceeding 
inductively, generation by generation, starting with the origin. The origin, and all non-cousin one-parent 
vertices, will be strong. All two-parent vertices will be weak. Finally, cousin vertices will be strong or weak 
according as their parent is weak or strong. We now define the weakened automaton B by having each vertex 
b ignore (1) its parent or parents, (2) its cousin (if it is a weak cousin vertex) and (3) itself (if q is even). 
Since q is at least 5 (6 if g is even), the threshold of each vertex is at least 3 (4 if g is even). Each strong 
vertex ignores at most 1 neighbor, and thus has reduced threshold at least 2, while each weak vertex ignores 
2 neighbors, and thus has reduced threshold at least 1. 
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First, we observe that a weak cousin- vertex that is a child of a strong cousin- vertex has a weak cousin- 
vertex as its cousin. Suppose, to obtain a contradiction, that the strong cousin-vertex a is the parent of 
weak cousin-vcrtcx fe, which has as its cousin tlic strong cousin- vertex c. Let d be the parent of c. Then d 
must be weak, since c is strong. But since b and c are cousins, at least one of their parents, a and d, must be 
a non-cousin one-parent vertex (by Lemma 2.6). The vertex a is a cousin- vertex, so d must be a non-cousin 
one-parent vertex. But this contradicts the fact that d is weak. 

Second, we observe that any cousin edge must be directed out of a strong cousin vertex and into a weak 
cousin vertex. To see this, note that by Lemma 2.6, two vertices that are cousins of each other must have 

least one non-cousin one-parent parent between them. This non-cousin one-parent vertex is strong, so at 
least one of the cousins is weak. But no cousin edge can be directed out of a weak cousin vertex, since weak 
cousin vertices ignore their cousin neighbors. Thus a cousin edge must be directed out of a strong cousin 
vertex, and into a weak one. 

We assign to each cousin-edge a flow of 2. We assign to each edge directed into a two-parent vertex a 
flow of 4. We assign to each parent-child edge directed into a weak cousin vertex having a strong cousin a 
flow of 6. We assign to each parent-child edge directed into a weak cousin vertex having a weak cousin a 
flow of 8. We assign to each other edge (that is, each edge directed into a non-cousin one-parent vertex or a 

strong cousin vertex) a flow of 9. 

A non-cousin one-parent vertex has in-degree 1 (from its parent), and thus has in-flow 9. It has out- 
degree at least 2 (its reduced threshold). None of its out-edges can be a cousin-edge (since they are directed 
from a non-cousin one-parent vertex), and at most one can be directed into a two-parent vertex (by Lemma 
2.4). Thus its out-flow is at least 4-1-6 = 10, so a non-cousin one-parent vertex has initially at least 10 — 9 = 1 
dollar. 

A two-parent vertex has in-degree at most 2 (from its parents), and thus has in-flow at most 4 -|- 4 = 8. 
It has out-degree at least 1 (its reduced threshold). None of its out-edges can be a cousin-edge (since two- 
parent vertices do not have cousins) or directed into a weak cousin vertex (since a two-parent vertex, which 
is weak, cannot have a weak cousin vertex as a child). Thus its out-flow is at least 9, so a two-parent vertex 
has initially at least 9 — 8 = 1 dollar. 

A strong cousin vertex has in-degree 1 (from its parent), and thus has in-flow 9. It has out-degree 
at least 2 (its reduced threshold). None of its out-edges can be directed into a two-parent vertex (since, 
by Lemma 2.5, the parents of a two-parent vertex are non-cousin one-parent vertices). At most one is a 
cousin-edge, with an out-flow of 2, and so at least one of its out-edges must bo directed into a non-cousin 
one-parent vertex (with an out-flow of 9) or into a weak cousin vertex. By the first observation above, such 
a weak cousin vertex must have a weak cousin vertex as its cousin, contributing an out-flow of 8 from the 
strong cousin vertex. Thus its total out-flow is at least 2 -|- 8 = 10, so a strong cousin vertex has initially at 
least 9 — 8 = 1 dollar. 

A weak cousin vertex with a strong cousin has in-degree at most 2 (from its cousin, its parent, or both). 

The in-flow from a cousin-edge is 2, and the in-flow from a parent is 6, so the total in-flow is at most 2-1-6 = 8. 
Its out-dcgrce is at least 1 (its reduced threshold) . None of its out-edges can be a cousin-edge (by the second 
observation above, weak cousin vertices do not have cousin-edges directed out of them), directed into a 
two-parent vertex (by Lemma 2.5, the parents of two-parent vertices are non-cousin one-parent vertices), 
or directed into a weak cousin vertex (a cousin vertex that is the child of a weak cousin vertex is strong). 
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Thus it must be directed into a non-cousin one-parent vertex or a strong cousin vertex, with an out-flow of 
9. Thus a weak cousin-vertex with a strong cousin has initially at least 1 dollar. 

A weak cousin vertex with a weak cousin has in-degree 1 (from its parent, since by the second observation 
above, no edge can be directed to it from its weak cousin). The in- flow from its parent is 8. Its out-degree 
is at least 1 (its reduced threshold). As in the preceding paragraph, an out-edge must be directed into a 
non-cousin one-parent vertex or a strong cousin vertex, with an out-flow of 9. Thus a weak cousin vertex 
with a weak cousin has initially at least 1 dollar. 

The analysis above shows that the in-flow of any vertex is at most 9. Thus each terminal vertex 
flnally has at most 9 dollars. We conclude that 9 times the number of terminals is at least the number of 

non-terminals, and thus that we may take M = 1 -|- 9/1 = 10 in Theorem 4.2. □ 

Propositions 4.3, 4.4, 4.5, 4.6 and 4.7 together prove the following theorem. 

Theorem 4-8: The tessellation {p, q} tolerates combined faults if p > 5 and g > 5, if p = 4 and g > 7, or if 
p = 3 and g > 9. 

4. Conclusion 

We have classified the regular tessellations of the plane for which binary cellular automata using sym- 
metric majority voting tolerate transient faults or combined faults. These results can be extended to a much 
broader class of tessellations: McCann [M2] has shown that cellular automata using majority voting and 
based on "nice" graphs tolerate transient or combined faults if the face and vertex degrees merely satisfy 
appropriate upper and lower bounds, together with a technical condition on the parities of face degrees. (A 
simple undirected graph is "nice" if it is connected, locally-finite, and discretely embeddable in the plane.) 

We should also point out that in our results we have not considered any transition functions other than 
those based on majority voting among all neighbors, which is symmetric under all automorphisms of the 
underlying graph. It is known, however, that in other contexts (see Pippenger [P]) asymmetric transition 
functions are able to achieve fault tolerance in some situations in which symmetric functions cannot. 
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